
THE SECRETARY OF DEFENSE 

WASHINGTON, THE DISTRICT OF COLUMBIA 


2 0 DEC 1988 



Honorable William Verity 
Secretary of Commerce 
Washington, D.C. 20230 

Dear Bill: 

Shortly after the Internet computer virus attack, which was 
first detected on November 2, 1988 , we formed an executive after 
action assessment team within the Department of Defense. The 
team met on November 14, 1988, and reviewed the events and 
actions taken after detection of the virus on ARPANET and 
MILNET; reviewed the report by the National Computer Security 
Center titled "Proceedings of the Virus Post-Mortem Meeting, 
November 8 , 1988 ," (Enclosure 1 ) ? reviewed the DARPA report on 
the technical characteristics of the virus (Enclosure 2); and 
concluded with recommendations for improving the Department's 
responsiveness to future attacks. 

As you will see from the team's report to me (Enclosure 3), 
the two areas on which we need to focus are the development of a 
central, national level coordination center, and increased 
computer security awareness. It became quickly evident during 
their analysis that the actions that need to be taken in the 
unclassified domain should be addressed by the National 
Institute of Standards and Technology (NIST) and the National 
Computer Security Center (NCSC), with technical coordination 
from the Defense Advanced Research Projects Agency. 

I have requested that each of the Defense Components 
involved in the after action assessment support the 
recommendations on a priority basis. In tasking the National 
Security Agency, I have asked that the NCSC be ready to work 
with the staff of NIST to address quickly the establishment of a 
central coordination center and the publication and wide 
distribution of computer security lessons learned from this 
incident. I solicit your personal support for this effort and 
ask that we move rapidly to improve our national posture to deal 
with potential computer security problems in the future. 

Sincerely, 



Enclosures: 
As Stated 
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